We do not share information that you give us with any third-parties.
This website uses cookies to better the users experience while visiting the website. Where applicable this website uses a cookie control system allowing the user on their first visit to the website to allow or disallow the use of cookies on their computer / device. This complies with recent legislation requirements for websites to obtain explicit consent from users before leaving behind or reading files such as cookies on a user’s computer / device.
Cookies are small files saved to the user’s computer hard drive that track, save and store information about the user’s interactions and usage of the website. This allows the website, through its server to provide the users with a tailored experience within this website.
Users are advised that if they wish to deny the use and saving of cookies from this website onto their computer’s hard drive they should take necessary steps within their web browser security settings to block all cookies from this website and its external serving vendors.
This website uses tracking software to monitor its visitors to better understand how they use it. The software will save a cookie to your computer hard drive in order to track and monitor your engagement and usage of the website but will not store, save or collect personal information.
Learning Platform Privacy Notice
1. Introduction
The ICT Service is a part of Cambridgeshire County Council and is fully committed to keeping your information safe.
This privacy notice is to help you understand what information The ICT Service collects, the purpose for which it is collected and who we share the information with. It also explains the decisions that you can make about your information.
This notice will provide you with the following information:
- Accountability
- Who is collecting information about my organisation?
- What information are you collecting about my organisation?
- Why are you collecting this information?
- What is the legal basis for processing my organisations information?
- Who might you share my organisations information with?
- Where might you transfer my organisations information outside the UK?
- How long do you keep hold of my organisations information?
- What if I choose not to give you my organisations information?
- Will you process my information or my organisations for purposes my organisation may not be aware of?
- Where is my organisations information processed?
- What rights do I have?
For the purposes of this Privacy Notice:
“Information” means the data held within the Learning Management System (LMS)
“Customer” means the establishment that purchases the service. i.e. individual school, Multi Academy Trust
“Data Controller” refers to the Customer
“Data Processor” refers to The ICT Service
“Data Subject” refers to a living persons details that are recorded in the LMS application by the Data Controller
“Individual” refers to a person or employee who is associated with a named Customer
“EEA” is the European Economic Area
“Organisation” refers to the individual school or academy
2. Accountability
The ICT Service provides you, the customer, with an account on the LMS that enables you to store the information for your schools’ users to provide a service that delivers training that your school have subscribed to.
As you are responsible for the information that is entered and maintained, this makes you, the customer, the Data Controller. The ICT Service delivers the service that provides you with the ability to store this information and as such does not enter your information into this system for you, this makes The ICT Service the Data Processor. As a Data Processor, The ICT Service provide a hosted service that includes the application and customer data as well as support services to the customer.
As the Data Controller you are responsible for the information in the LMS site and must be able to demonstrate compliance with the Data Protection Act and General Data Protection Regulations for the processing of personal information.
The ICT Service must demonstrate the same compliancy for any processing of your Data.
Details of the Data Protection Act Principles are detailed on the Information Commissioner’s Office website: https://ico.org.uk/for-organisations/guide-to-data-protection/data-protection-principles/
3. Who is collecting information about my organisation?
The ICT Service
Speke House
Compass Point Business Park
Stocks Bridge Way
St. Ives
Cambridgeshire
PE27 5JL
Website: https://theictservice.org.uk/
Should you have any queries relating to the collection of your information or about this policy please contact the Data Privacy Officer at support@theictservice.org.uk
4. What information are you collecting about my organisation?
For the purposes of delivering elearning to your organisation, the contents of your organisations data is stored on our hosted LMS servers, together with administrative files in the shared file storage and the hosted email systems.
We also collect session information from those users accessing our system, this includes the use of third party technologies, these include, Google Analytics and logs from Microsoft Applications.
This information will be used for the following:
- To enhance the security of the system by tracking suspicious and anomalous behaviour.
- To assist The ICT Service support and operations functions to tune their services to provide scalable and performant software using utilisation information over a period of time
- To monitor the usage of our services and systems to support the development and enhancement of future features
See Cambridgeshire County Council’s data privacy notice at https://www.cambridgeshire.gov.uk/data-protection-and-foi/information-and-data-sharing/privacy-statement/ or information on customer information collected as part of the LMS Service.
5. Why are you collecting this information?
In order to meet the contractual requirements of the LMS Service to the customer, file storage and email storage is hosted on our systems.
On occasion, we may request customer permission to use customer data for development and test purposes to develop enhancements against the future service. Where this is agreed, The ICT Service will provide the customer with Data Agreement of Use form that details the terms of use of customer data under this agreement.
Service usage and performance information is used to understand the service and to make further enhancements that will benefit our customers.
6. What is your legal basis for processing my organisations information?
The ICT Service requires this information to provide individual learning experience service to our customers.
The ICT Service, as data processor, supports the customer to meet their legal requirements and as data controller, it is the customer’s responsibility to ensure that they have a legitimate reason for processing the data subject’s information entered into hosted LMS.
7. Who might you share my organisation’s information with?
We may share your data and/or school information with the following parties:
- Internal ICT Service parties for the purpose of data investigation as and when issues are reported by the customer
- Capita for the purpose of data investigation as and when issues are reported by the customer.
- To comply with any court order or other legal obligation
It should be noted that your information is only shared with other parties where the customer has provided prior consent to do so and is stated in your contract with the exception of a legal obligation.
8. Where might you transfer my organisation’s information outside of the EEA?
The ICT Service will not be transferring any data outside of the EEA
9. Is my organisation’s data processed other than for the purposes of the use of the hosted LMS
No
10. How long do you keep hold of my organisation’s information?
LMS information will be hosted by The ICT Service for the duration of the contract with the customer. In the event of a contract termination the information will be removed from the LMS systems. Copies of the data may be held in Backup cycles for up to 7 years.
11. What if I choose not to give you my organisation’s information?
If you are unable to provide your school establishment details then we will not be able to enter a contract with you. We require this information in order to provide a contract between your school establishment and The ICT Service which includes the Terms and Conditions of the service.
In the event that you report a data issue with your LMS information to the Service Desk and you choose not to issue consent to use your school LMS information, we may not be able to offer our full range of support for further investigation
12. Will you process my information for purposes I may not be aware of?
No
13. Where is my organisations data processed?
The LMS service is hosted on a secure managed service, with the main system hosting provided in Cambridgeshire County Council’s Data Centre in Cambridge. Some is also processed via Microsoft Azure® UK, which is reliable and resilient. Microsoft Windows Azure has G-Cloud Impact Level 2 (IL2) from the Cabinet Office for use across the UK Public Sector. All data is securely stored and processed within the EU and complies with UK data protection standards and requirements.
14. What security is in place for my organisations data?
See Question 13.
Hosting and management of hosted LMS infrastructure is undertaken fully by The ICT Service on behalf of the establishment, including the provision of all software, maintenance operations, upgrades and background supporting processes. Application security is SSL (TLS 1.0): The SSL method requires the use of TLS 1.0 to authenticate the RD Session Host server. A High setting for encryption is also applied so data sent from the client to the server and from the server to the client uses strong 128-bit encryption. Clients that do not support TLS and this encryption level cannot connect to RD Session Host servers.
The Data Centre Services and network are subject to rigorous firewall and intruder detection testing.
15. Is there a cookie policy?
Cookies are only used for Hosted LMS to capture client device information to aid reconnections to existing sessions. When a user connects to the platform a cookie is checked and then verified against a database, if an existing session with all matching details exists users will be reconnected to their existing session otherwise a new session is created.
16. What rights do I have?
The right to be informed:
The ICT Service have an obligation to provide you, the customer, with fair processing information. This is delivered to you in the LMS Privacy Notice and includes information relating to the processing of your school file, email and LMS information.
The right of access:
This does not apply to The ICT Service for the LMS who act as a data processor and are not responsible for subject access requests for information stored in the LMS or other stored files or email, these are to be conducted by the customer, as data controller.
Where you wish to make a request to access data that The ICT Service hold about you or your organisation, please refer to Cambridgeshire County Council’s data privacy notice at https://www.cambridgeshire.gov.uk/data-protection-and-foi/information-and-data-sharing/privacy-statement/
The right to rectification
Please refer to Cambridgeshire County Council’s data privacy notice at https://www.cambridgeshire.gov.uk/data-protection-and-foi/information-and-data-sharing/privacy-statement/ for contact information to rectify or update any information that The ICT Service has recorded against you or your organisation in their systems.
The right to erasure (also known as the “right to be forgotten”)
As data controller, it is the customers responsibility to respond to and act upon requests where the data subject has requested for the removal of information stored about them in the LMS or other stored files or email.
Please refer to Cambridgeshire County Council’s data privacy notice at https://www.cambridgeshire.gov.uk/data-protection-and-foi/information-and-data-sharing/privacy-statement/ for contact information to make such request to The ICT Service on information stored about you or your organisation in their systems.
The right to restrict processing
Individuals who are associated with a customer have the right to request that processing of their information is not processed. As data controller, the customer must respond to such requests.
The right to data portability
Upon termination of the LMS contract, as a customer, you have the right to request a copy of your LMS records. You should make such requests via the Service Desk and note this may be subject to a charge.